An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in ioctlmappage() when mounting and operating a crafted btrfs image, because of a lack of block group item validation in checkleaf_item in fs/btrfs/tree-checker.c.